The Capability Blind Spot in Brazil's AI Bill

A private clinic uses an AI scheduling assistant to prioritize callback requests. To reduce delays, the assistant begins routing patients’ descriptions through a “generic” wellbeing-scoring service. No engineer selected that service: the AI assistant found it, tested it, and kept using it because it improved the queue metric.

A patient recovering from chemotherapy reports symptoms the service does not recognize. The assistant assigns a routine callback instead of an urgent one. By the time a clinician responds, a treatable complication requires hospitalization.

The assistant did not diagnose the patient. But its tool choice and queue decision jointly performed part of a clinical triage function.

Would Brazil’s proposed AI law, Projeto de Lei (PL) 2338/2023, treat it as high-risk? Perhaps, but only through a contested interpretation. Article 14 lists twelve purposes that make a system high-risk automatically, from credit and hiring decisions to policing and critical infrastructure. Article 14(V) expressly covers call classification and priority-setting for essential public services, including medical assistance. Article 14(IV) can cover essential private services, though whether this decision counts as access is less clear. The article’s single unnumbered clause also excludes systems performing a narrow procedural task. A regulator or court might classify the assistant as high-risk; a deployer might plausibly argue the opposite. None of these routes asks first whether the system can plan, select tools, and take consequential action without substantive approval (Figure 1). (Senate-approved text, Arts. 12–16)

That is the blind spot: a domain-based list must infer risk from what a system was introduced to do. An agent can assemble a materially different function after deployment.

Figure 1. The problem is not that the private system is certainly exempt. It is that its capabilities never independently trigger review.

Agentic capability has no independent route into classification

Brazil’s PL 2338/2023 classifies high-risk systems mainly through listed purposes and contexts, resembling the EU AI Act’s sector-and-use organization of high-risk rules. Agentic systems put pressure on that structure because they can plan over several steps, use external tools or other models, and change how a task is performed at runtime (Chan et al., 2023; Staufer et al., 2026).

The nearest legislative analogue is Annex XIII of the EU AI Act, which asks regulators to weigh autonomy, scalability and tool access when designating general-purpose models with systemic risk. That precedent addresses the model developer and ecosystem-level risk, not the deployer who connects a model to patient records, payments or communications. (EU AI Act, Annex XIII)

A close prior work is Gardhouse, Oueslati, and Kolt, whose paper (2026) finds the EU AI Act was not built to handle five governance challenges: performance, misuse, privacy, equity, and oversight. Their companion piece puts the oversight problem directly: the Act’s “‘stop button’ requirement treats halting as straightforward” for agents whose actions may be impossible to undo (Gardhouse & Oueslati, 2026), paralleling the supervision finding below. Nannini et al. (2026) map agent deployment categories against the Act’s provisions in more procedural detail, proposing a twelve-step compliance architecture for providers. Both diagnose closely related problems and develop EU-focused governance or compliance responses; neither proposes the deployer-facing statutory trigger developed here. Among the closest work I identified, none applies this approach to a Global South AI statute. My contribution is coded diagnosis plus at a minimally-scoped legislative amendment.

An article-by-article review finds no unconditional capability safeguard

I reviewed all 80 articles of the Senate-approved text (formally, Parecer nº 208/2024-PLEN/SF, approved 10 December 2024) against eight dimensions of agentic risk. A dimension was coded unconditional only if an operative provision addressed it without first requiring classification by purpose, sector or actor. I also argued against the four most contestable codings and traced four hypothetical deployments through the classification rules. These are the author’s textual codings, not judicial findings.

Table 1. Coverage of eight agentic-risk dimensions in PL 2338/2023.

The strongest result is that no capability independently compels a second look (Table 1). Existing safeguards can be substantial once high-risk status attaches: Article 18 imposes governance duties, Article 25 requires an algorithmic impact assessment, and Article 8 provides for human supervision. The gap is the route into that package. (Senate-approved text, Arts. 8, 18 and 25)

One capability criterion needs a rule that actually binds someone

Article 15 tells the National System for Artificial Intelligence Regulation and Governance (SIA) how to identify new high-risk applications by regulation, using at least one of ten listed criteria. Adding “autonomy” as an eleventh criterion there would give the SIA a new factor for future rulemaking. It would not, on its own, classify a single deployed system. The amendment needs an operative rule that binds without waiting for the SIA to act, and it needs to say plainly how far that rule reaches: a capability trigger that quietly borrowed the full high-risk package would concede exactly what a deployer’s lawyer would attack first. I propose:

1. A cumulative capability criterion, added to Article 15. The threshold requires both:

1. multi-step planning without substantive human approval at each consequential stage (disregarding approval that is merely formal or that leaves no real possibility of review, modification, or veto); and
2. execution of consequential action through tools, application programming interfaces (APIs), self-executed code, or a functionally equivalent intermediary.

This gives capability a recognized criterion type inside Article 15’s list. By itself, it binds no one. So why not state the test only in the binding rule below, skipping Article 15 entirely? Because Article 15 is where the SIA already holds standing authority to extend the high-risk list by regulation. Once capability exists there as a criterion type, extending it to further classes, like replication, becomes a regulatory act, not a new legislative cycle. The Article 12 rule binds today; Article 15 is what lets the framework grow without returning to Congress.

2. A directly binding companion rule, added as Article 12, §7º(I–II). Once a system meets criterion XI’s cumulative test, regardless of Article 14 purpose, two duties attach once the law takes effect (Article 80 sets a 730-day delay before general entry into force): the preliminary assessment becomes mandatory rather than optional (§7º, I), and the deployer must keep a record of the system’s consequential actions, its tool and API calls, and any human approval, modification or veto that occurred during operation (§7º, II). This is new text. It is not an extension of Article 23(I), which already exists and records only who used a public-sector system and for what purpose, not what the system did.

3. A registration duty, at Article 12, §7º(III). The deployer must register the system before deployment: a stable identifier, the deployer’s identity, and the assessment’s status, filed with the competent authority, using the administrative infrastructure Article 44 already establishes for its public high-risk database, without depending on the impact-assessment documents that database is built to hold. This helps only compliant deployers: one who skips the assessment may skip registering as well, leaving the regulator unable to find the systems that most need finding. A more complete design would surface the identifier in the system’s own interfaces and consequential actions, so affected people and regulators could trace conduct back to the registry — a future design question, not something this text does yet.

Figure 2. Removing any one of these three parts recreates the original gap.

Article 12, §9º defines the terms §7º depends on, so the binding rule has determinate content rather than waiting on the SIA to supply one:

• Substantive human approval requires real, timely opportunity to examine the specific action before execution, and genuine capacity to modify or block it. Ratification after the fact does not count.
• Consequential action means action with effect external to the system’s own environment: it alters a person’s legal, financial, contractual, or health situation, commits resources or access on a third party’s behalf, or non-trivially modifies a third party’s data or systems. Read-only queries, unexecuted drafts, and sandboxed test actions do not count.
• Multi-step planning means two or more sequential actions where a later one depends on information or a decision from an earlier one, with no substantive approval between them.

Future SIA rulemaking under Article 15 can refine these definitions; it does not have to supply them from nothing.

What the trigger (deliberately) does not do

Article 12, §8º states, in the amendment’s own text, that meeting criterion XI does not classify the system as high-risk under Article 14, and does not on its own trigger Article 18’s governance duties, Article 25’s impact assessment, or Article 8’s human-supervision right. This keeps the amendment at the bill’s lightest tier deliberately. It has a real consequence: human oversight under Article 8 does not attach to a system captured only by criterion XI. Because the trigger is cumulative, it does not independently close D1–D4: the amendment creates one narrow compound trigger spanning autonomy, tool-mediated action, multi-step planning, and consequential action (D1–D4), and adds action traceability (D6) through the new logging duty at §7º(II). It does not reach D5, human supervision and intervention.

That limit is defensible: the amendment’s function is to make an invisible configuration visible to a regulator that currently cannot see it at all, at the lowest tier that achieves visibility and evidence. Whether oversight duties should follow is a question the SIA can take up under Article 15’s existing authority once it knows how many systems the criterion actually captures.

Why in the classification chapter, not the systemic-risk one

PL 2338’s Articles 29–33 primarily govern developers of general-purpose and generative AI. The clinic problem arises later, when a deployer configures a model to plan and act in a particular environment.

Table 2. Two routes into obligations for agentic systems.

These routes complement rather than replace each other. Autonomous replication and multi-instance coordination remain better candidates for the systemic-risk chapter. The trigger is narrower by design, addressing systems already capable of acting consequentially in a concrete deployment, and stopping there.

Limitations and future work

This is a single-coder textual analysis by a non-lawyer. The clinic scenario illustrates statutory ambiguity; it is not a finding that private clinical triage is definitively exempt. §9º’s definitions still leave “non-trivial” undefined for consequential action: a numeric bright line would close this more fully, but it is a policy choice, not one this timeline should invent unsupported. The bill also has no existing anchor for a retention period for the action records required under §7º(II).

Further work should test the same capability-versus-domain question in emerging Latin American frameworks; design a reassessment trigger for systems whose capabilities change after deployment; and examine replication and multi-agent coordination under the systemic-risk provisions. Whether to revisit the stop short of Article 8 oversight is also future work.

The legislative window remains open

As of late August 2026, the Chamber of Deputies still listed PL 2338/2023 as awaiting the special committee rapporteur’s opinion (the “relator,” the committee member responsible for the report). That status can change quickly, but it leaves an opportunity to add a capability route before the bill advances toward a floor vote. (Chamber tracker)

Criterion XI would not solve agentic AI risk in Brazil. It would do something narrower and necessary: ensure that a system’s capacity to plan and act can itself trigger assessment and evidence, rather than remaining legally visible only when its declared purpose happens to fit a list, while stating, in its own text, exactly how far that trigger reaches and no further.

One request: the proposed amendment and article-by-article codings must be reviewed by a Brazilian digital-law specialist before they are used in policy advocacy. If that is your field, please contact me through the project page.

Full paper, coding notes, and article-by-article justifications: Capabilities, Not Just Domains — Apart Research. A companion addendum expands the criterion XI stress-test, the primary-text EU AI Act comparison, and the attribution design.

Acknowledgements

Thanks to Apart Research for hosting the Global South AI Safety Hackathon that initiated this project, and to the Research Sprint and Apart Lab reviewers whose criticism substantially changed the proposed remedy.

LLM usage

Claude (Anthropic) was used for brainstorming, drafting, review, close-reading, and coding of PL 2338, and citation checks. ChatGPT and Gemini were used for evaluation and revision. The author checked legal-text citations against the primary sources and remains responsible for the analysis.